RealTime IT News

New Trojan Pretends to be Antivirus Software

Anti-virus maker F-Secure warned mobile phone users about a slippery new trojan disguising itself as an antivirus application.

Although the worm, dubbed Skulls.L, is similar to the Skulls.C trojan, writers have added a new wrinkle that differentiates it from previous variants: It's advertised with a name used for F-Secure's Mobile Anti-Virus installation package.

"The trojan obviously does not contain pirate copied version of anti-virus, it breaks the system applications on the phone, so that none of the smartphone functions of the phone are (sic) as long as the phone is infected," Jarno Niemela, a virus researcher, wrote on the company's weblog.

The Skulls trojan, which affects only Symbian-based mobile phones, first surfaced in November. The only difference in Skulls.C is the disguise.

Once transmitted, Skulls.L can appear in mobile phone dialog boxes with the text "F-Secure Antivirus protects you against the virus. And dont forget to update this!"

The virus is capable of disabling smartphone features by deactivating messaging, net access and other applications, F-Secure said.

"Once this occurs the application icons on the phone are replaced with pictures of skulls. F-Secure's mobile anti-virus is signed by Symbian - unlike Skulls trojans - and the warning about missing installation package signatures should be a giveaway it is bogus," the company said.

The company recommends against downloading F-Secure anti-virus files from any server other than its own.

"If Skulls.L is installed, only the calling and answering functions of the phone will continue to work. Functions that need some type of system application, such as SMS and MMS messaging, Web browsing and cameras, will not work.